CVE-2026-78689: CWE-122 in F5 NGINX JavaScript

CVE-2026-78689 is a heap-based buffer overflow (CWE-122) in the XML module of NGINX JavaScript (njs), specifically in the namespace prefix list parser used by the xml.exclusiveC14n() method. An attacker can remotely trigger this vulnerability by supplying a crafted XML namespace prefix list to this method in an affected NGINX configuration. Both the njs and QuickJS JavaScript engines are impacted. The njs engine suffers from adjacent object corruption and worker crashes, while the QuickJS engine leaks memory on each invocation, causing worker memory growth. The nginxinc/nginx-saml reference implementation is vulnerable during SAML signature verification because it processes untrusted InclusiveNamespaces/@PrefixList data before signature validation. Although code execution has not been demonstrated, the out-of-bounds write could potentially lead to it depending on runtime conditions. This vulnerability allows denial of service via worker restarts or memory exhaustion. No control plane components are affected.

Remote attackers can cause denial of service on NGINX systems by triggering worker process crashes or memory growth. The vulnerability may also allow code execution, but this has not been demonstrated and depends on uncontrollable conditions. The issue affects the data plane only, with no control plane exposure. The nginxinc/nginx-saml reference implementation is vulnerable to crafted SAML messages that exploit this flaw before signature verification.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Until a patch is available, avoid passing externally controlled XML namespace prefix lists to the xml.exclusiveC14n() method, especially in SAML processing contexts. Monitor vendor communications for updates and apply official fixes once released.